CVE-2026-17556

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22

Description A path traversal issue allows an unauthenticated attacker with network reachability to delete arbitrary files and directories on the instance, including the user storage directory containing Git LFS objects, release assets, attachments, and avatars. This occurs because the X-GitHub-Request-Id request header is used without sanitization as a filesystem path segment for the upload buffer directory. A traversal value can point the buffer to an arbitrary path, which is then recursively removed by the deferred cleanup routine. This issue persists even when private mode is enabled.

Recommendations Update to version 3.21.4 Update to version 3.20.6 Update to version 3.19.10 Update to version 3.18.13 Update to version 3.17.19